Cyberattacks on colleges and universities are on the rise following many institutions’ transition to online and hybrid classes.
Higher education institutions’ databases are gold mines for cybercriminals because they store massive amounts of personally identifiable information (PII) like social security numbers and payment information. If an attack is successful, cybercriminals can expose this data, risking identity theft, fraud and exorbitant costs for schools. In 2019, the average cost for data breaches in the U.S. education industry rose to $142 per record loss–$45 above the worldwide average.
As education becomes more digitized, the pressure to keep student data safe and mitigate the impact of costly data breaches is at an all-time high. Devaluing students’ data could be the solution for this issue that many institutions face as they transition to e-learning environments.
Attackers targeting colleges and universities: Why and how?
The primary motive for data breaches is financial gain. Cybercriminals use social engineering tactics, like phishing, to obtain PII and sell it on the black market, often for hundreds of dollars. Attackers also use ransomware, which is a form of malware that encrypts a victim’s files, essentially holding the victim’s data hostage until they pay the attacker.
Human error accounts for 35 percent of data breaches in the education sector. Institutions spend little time training educators in cybersafety, and most still don’t have adequate cybersecurity training. It doesn’t help that only 5 percent of college and university budgets are allocated to IT services. The lack of cybersecurity training within institutions, along with the thousands of users on the network who are using personal devices creates easier access to data for attackers. They often can take advantage of unsuspecting students and faculty by tricking them into clicking on phishing links in emails and other malicious tactics.
Ruston Miles founded Bluefin and also serves as the company’s chief cybersecurity advisor. Ruston brings over 20 years of payment and security experience, having architected Bluefin’s payment gateway and PCI-validated point-to-point encryption (P2PE) solutions, as well as contributing to the innovation of the company’s tokenization solutions. Ruston is a national speaker on cyber and payment security topics and was featured in more than 12 publications in 2020, including Forbes, TechCrunch, ZDNet, PaymentsSource and Yahoo! Ruston is a PCI Professional (PCIP), Certified Payment Professional (CPP), Certified Internet Business Strategist (CIBS), and an active participant with the PCI Security Standards Council (SSC).
- To rebuild adult learner confidence, universities must first earn their trust - August 24, 2026
- Schools are building AI rules before they know the destination - August 17, 2026
- Cohort connections matter: Strategies to help graduate students persist and succeed - August 14, 2026